CVE-2026-110264: 
Ruby analisi e mitigazione delle vulnerabilità

CVE-2026-110264 is a critical unauthenticated remote code execution (RCE) vulnerability in GitLab CE/EE caused by an integer overflow when compiling a specially crafted regular expression. It affects all GitLab versions from 7.0 through the patched releases, spanning approximately 12 years of releases. Affected version ranges include 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1. The vulnerability was published on October 22, 2026, and carries a CVSS v3.1 base score of 10.0 (Critical) with a changed scope, reflecting its network-accessible, no-authentication-required attack surface (Feedly, EUVD).

The root cause is an integer overflow (CWE-190, mapped to CAPEC-92 "Forced Integer Overflow") in GitLab's regular expression compilation engine. When a user-supplied regular expression is processed, an arithmetic overflow in the compiler's internal size or counter calculations can corrupt memory or control flow, ultimately enabling arbitrary code execution on the server. No authentication is required, and the attack complexity is low — an attacker only needs to submit a specially crafted regex string to a GitLab endpoint that accepts user input and triggers regex compilation. The HackerOne report (H1 #4093475) and the GitLab work item #633633 are the primary technical references, though full exploitation details have not been publicly disclosed (Feedly, HackerOne).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code on a self-managed GitLab server with the privileges of the GitLab service process, resulting in complete compromise of confidentiality, integrity, and availability. An attacker could exfiltrate source code repositories, secrets, CI/CD pipeline credentials, and user data; tamper with code or pipelines to introduce supply chain backdoors; or disrupt GitLab service availability entirely. The changed scope in the CVSS vector indicates that impact can extend beyond the GitLab application itself to the underlying host and connected infrastructure, enabling lateral movement within the organization (Feedly, EUVD).

As of the time of disclosure, there is no public proof-of-concept exploit and no confirmed in-the-wild exploitation (Feedly). The EPSS score is currently 0.0, reflecting the early stage of the vulnerability's public lifecycle (EUVD). The vulnerability has not yet been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the combination of a CVSS 10.0 score, no authentication requirement, low attack complexity, and the extremely broad affected version range (12+ years of releases) makes this a high-priority target for threat actors, and weaponization risk is elevated.

1. Reconnaissance: Identify internet-facing self-managed GitLab instances using tools such as Shodan, Censys, or FOFA, filtering for GitLab login pages or API endpoints. Confirm the version is within the affected range (7.0 – 18.11.12, 19.0.x – 19.4.2, or 19.5.0).
2. Identify regex-accepting endpoints: Locate GitLab features that accept user-supplied regular expressions without authentication, such as search endpoints, issue/MR filters, or API endpoints that process regex patterns (e.g., /api/v4/ routes or public project search).
3. Craft malicious regex payload: Construct a specially crafted regular expression designed to trigger an integer overflow in GitLab's regex compilation engine — for example, a deeply nested or extremely large quantifier pattern that causes an arithmetic wraparound in internal size calculations.
4. Submit the payload: Send an HTTP request (GET or POST) to the identified endpoint with the malicious regex as a parameter, without providing any authentication credentials.
5. Achieve code execution: The integer overflow corrupts memory or redirects execution flow during regex compilation, resulting in arbitrary code execution on the GitLab server under the service account's privileges, enabling reverse shell establishment, credential harvesting, or further post-exploitation activity (Feedly, HackerOne).

• Network: Unusual or malformed HTTP requests to GitLab search, filter, or API endpoints containing abnormally long or deeply nested regular expression patterns; unexpected outbound connections from the GitLab server to external IPs (potential reverse shell or C2 traffic).
• Logs: GitLab application logs (production.log) showing requests with oversized or malformed search, regex, or filter parameters from unauthenticated sources; Ruby/Rails crash reports or segmentation fault entries in gitlab-rails/exceptions_json.log.
• Process: Unexpected child processes spawned by the GitLab Rails or Puma worker processes (e.g., /bin/bash, sh, curl, wget, python, ruby -e); unusual process trees originating from gitlab-workhorse or puma.
• File System: New or modified files in GitLab installation directories (e.g., /var/opt/gitlab/, /home/git/), unexpected cron jobs, SSH authorized_keys modifications, or web shells placed in public asset directories.
• Registry/Config: Unauthorized changes to GitLab application settings, new admin accounts created, or SSH keys added to the git system user (Feedly).

GitLab has released patched versions addressing this vulnerability: 18.11.13, 19.0.10, 19.1.9, 19.2.9, 19.3.6, 19.4.3, and 19.5.1. All self-managed GitLab administrators should upgrade to the appropriate patched version immediately. If immediate patching is not possible, restrict network access to GitLab servers (e.g., firewall rules limiting access to trusted IP ranges), disable or restrict public-facing features that accept user-supplied regular expressions, and monitor logs for anomalous regex-related activity. GitLab.com (SaaS) is managed by GitLab and is not affected by this issue for self-managed customers (GitLab Patch Release, Feedly).

The vulnerability generated significant attention across the security community upon disclosure on October 22, 2026, trending rapidly on Feedly and across social platforms including Mastodon, Bluesky, and LinkedIn. Coverage from outlets such as The Hacker News, GBHackers, CyberSecurityNews, and Cyberpress highlighted the 12-year scope of affected releases and the maximum CVSS score as particularly alarming. Security researchers on Mastodon and Infosec.Exchange noted the rarity of a CVSS 10.0 unauthenticated RCE in a widely deployed DevOps platform, with some emphasizing the supply chain risk given GitLab's role in CI/CD pipelines. Beazley Security Labs published an advisory (BSL-A1235), and threat intelligence platforms including ThreadLinqs and CTIP Pilot issued tracking entries shortly after disclosure (The Hacker News, GBHackers, Beazley Security).